Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

MyDoom Attack On Microsoft Falters: Page 3 of 5

A worm must reach an infection threshold to successfully conduct a DoS attack, said Kuo, and Mydoom.b just didn't make it. "If a worm's not managed to get out there, to reach that magic threshold, it's very, very difficult for it to spread."

According to Network Associates' estimates, only about 10,000 machines worldwide have been infected with the Mydoom.b worm. Compare that to the 500,000 machines infected with the original Mydoom.a, which didn't target Microsoft.com, and it's easy to see why the Redmond, Wash.-based developer's Web sites remained up and running.

But numbers don't tell the whole story, said Kuo.

Both Mydoom.a and Mydoom.b have a programming error that limits the number of infected machines which will conduct the DoS attacks at the same time.

Only about seven percent of the Mydoom.b-compromised computers actually attack Microsoft.com simultaneously, according to Network Associates' analysis, said Kuo. (Mydoom.a also sports the same bug, but in its case, about 25 percent of the infected machines are able to attack The SCO Group's site at the same time.)